https://flanksource.com/assets/js/0d901184.541e4959.js

1"use strict";(globalThis.webpackChunkmission_control=globalThis.webpackChunkmission_control||[]).push([[2054],{28211(e,s,r){r.d(s,{U_:()=>l,tb:()=>a,v0:()=>c});r(96540);var i=r(97486),n=r(74848);const t={scraper:{icon:i.pUm,label:"Scraper",anchor:"catalog",color:"#2563eb",bg:"#dbeafe",border:"#93c5fd"},healthcheck:{icon:i.XkQ,label:"Health Check",anchor:"health-checks",color:"#d97706",bg:"#fef3c7",border:"#fcd34d"},playbook:{icon:i.WxB,label:"Playbook",anchor:"playbooks",color:"#7c3aed",bg:"#ede9fe",border:"#c4b5fd"},notifications:{icon:i.IrQ,label:"Notifications",anchor:"notifications",color:"#16a34a",bg:"#dcfce7",border:"#86efac"},actions:{icon:i.KD0,label:"Actions",anchor:"actions",color:"#4f46e5",bg:"#e0e7ff",border:"#a5b4fc"},relationship:{icon:i.pUm,label:"Relationship",anchor:"relationship",color:"#d97706",bg:"#fef3c7",border:"#fcd34d"}};function l({type:e,label:s}){const r=t[e];if(!r)return null;const i=r.icon;return(0,n.jsxs)("span",{className:"inline-flex items-center gap-1.5 px-3 py-1 rounded-full text-sm font-medium",style:{backgroundColor:r.bg,color:r.color,border:`1px solid ${r.border}`},children:[(0,n.jsx)(i,{className:"w-4 h-4"}),s||r.label]})}function c({children:e}){return(0,n.jsx)("div",{className:"flex flex-wrap gap-2 mb-6 not-prose",children:e})}function a({type:e}){const s=t[e];if(!s)return null;const r=s.icon;return(0,n.jsx)("h2",{id:s.anchor,className:"flex items-center gap-2 mt-8 mb-4 not-prose",children:(0,n.jsxs)("span",{className:"inline-flex items-center gap-1.5 px-3 py-1.5 rounded-full text-base font-medium",style:{backgroundColor:s.bg,color:s.color,border:`1px solid ${s.border}`},children:[(0,n.jsx)(r,{className:"w-5 h-5"}),s.label]})})}},34351(e,s,r){r(96540);var i=r(21733),n=r(92224),t=r(34164),l=r(74848);r.d(s,["C",0,({columns:e=3,gap:s="gap-x-4 gap-y-4",children:r})=>(0,l.jsx)("div",{className:(0,t.A)("text-slate-900 grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3",s),children:r}),"Z",0,({title:e,icon:s,size:r="md",height:c="min-h-20 md:min-h-32",link:a,href:o,variant:d="primary",bordered:h=!0,padded:p=!0,sidebar:x,children:u})=>{a=a||o,x&&(a=x.href,x.customProps?.icon&&(s=(0,l.jsx)(n.A,{name:x.customProps?.icon})),e=x.label),s&&"string"==typeof s&&(s=(0,l.jsx)(n.A,{name:s}));const j=(0,l.jsx)("div",{className:(0,t.A)(c,"flex rounded-lg",h&&"border border-slate-200 border-solid hover:border-slate-300 hover:shadow-lg",p&&"md"==r&&"p-2 sm:p-5",p&&"sm"==r&&"p-1 sm:p-2",r),children:(0,l.jsxs)("div",{className:"items-start flex-col flex-grow justify-around flex",children:[(0,l.jsxs)("span",{className:"flex flex-row items-center space-x-1 ",children:[s&&s,(0,l.jsx)("span",{className:(0,t.A)("md"==r&&"text-2xl","sm"==r&&"text-xl"),children:e})]}),u]})});return a?(0,l.jsx)(i.A,{to:a,className:"unstyled  ",children:j}):j}])},7351(e,s,r){r.d(s,{A:()=>t});r(96540);var i=r(46916),n=r(74848);function t({children:e,fallback:s}){return(0,i.A)()?(0,n.jsx)(n.Fragment,{children:e?.()}):s??null}},56113(e,s,r){r(96540);var i=r(21733),n=r(92224),t=r(34164),l=r(74848);r.d(s,["C",0,({columns:e=3,gap:s="gap-x-4 gap-y-4",children:r})=>(0,l.jsx)("div",{className:(0,t.A)("text-slate-900 grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3",s),children:r}),"Z",0,({title:e,icon:s,size:r="md",height:c="min-h-20 md:min-h-32",link:a,href:o,variant:d="primary",bordered:h=!0,padded:p=!0,sidebar:x,children:u})=>{a=a||o,x&&(a=x.href,x.customProps?.icon&&(s=(0,l.jsx)(n.A,{name:x.customProps?.icon})),e=x.label),s&&"string"==typeof s&&(s=(0,l.jsx)(n.A,{name:s}));const j=(0,l.jsx)("div",{className:(0,t.A)(c,"flex rounded-lg",h&&"border border-slate-200 border-solid hover:border-slate-300 hover:shadow-lg",p&&"md"==r&&"p-2 sm:p-5",p&&"sm"==r&&"p-1 sm:p-2",r),children:(0,l.jsxs)("div",{className:"items-start flex-col flex-grow justify-around flex",children:[(0,l.jsxs)("span",{className:"flex flex-row items-center space-x-1 ",children:[s&&s,(0,l.jsx)("span",{className:(0,t.A)("md"==r&&"text-2xl","sm"==r&&"text-xl"),children:e})]}),u]})});return a?(0,l.jsx)(i.A,{to:a,className:"unstyled  ",children:j}):j}])},92224(e,s,r){r.d(s,{A:()=>a});r(96540);var i=r(97486),n=r(37399),t=r(91406),l=r(34164),c=r(74848);

1function a({name:e,height:s=22,className:r,url:a,children:o,...d}){if("config-db"==(e=e.replaceAll("--","-").replaceAll("::","-").toLowerCase().replaceAll("k8-","k8s-").replaceAll("kubernetes-","k8s-")))return(0,c.jsx)(t.ntS,{...d});if("canary-checker"==e&&(e="heart"),"getting-started"==e&&(e="lsicon:path-outline"),"concepts"==e&&(e="fluent:brain-circuit-24-regular"),"events"==e&&(e="carbon:lightning"),"tutorial"==e&&(e="learning"),"dedupe"==e)return(0,c.jsx)("svg",{xmlns:"http://www.w3.org/2000/svg",x:"0px",y:"0px",width:"20",height:"20",viewBox:"0 0 50 50",children:(0,c.jsx)("path",{d:"M 17 4 L 17 6 L 44 6 L 44 40 L 36 40 L 36 42 L 46 42 L 46 4 L 17 4 z M 4 8 L 4 46 L 34 46 L 34 45 L 34 8 L 4 8 z M 6 10 L 32 10 L 32 44 L 6 44 L 6 10 z M 18 20 L 18 26 L 12 26 L 12 28 L 18 28 L 18 34 L 20 34 L 20 28 L 26 28 L 26 26 L 20 26 L 20 20 L 18 20 z"})});if("rate-limit"==e)return(0,c.jsx)("svg",{xmlns:"http://www.w3.org/2000/svg",fill:"currentColor",...d,width:"20",height:"20",viewBox:"0 0 50 50",children:(0,c.jsx)("path",{d:"M 25 2 C 12.316406 2 2 12.316406 2 25 C 2 37.683594 12.316406 48 25 48 C 37.683594 48 48 37.683594 48 25 C 48 12.316406 37.683594 2 25 2 Z M 32.5 16.1875 C 37.601563 16.1875 38.09375 21.007813 38.09375 22.90625 C 38.09375 23.605469 38.09375 24.210938 38.09375 24.8125 C 38.09375 30.3125 36.90625 33.40625 32.40625 33.40625 C 28.90625 33.40625 26.6875 31.511719 26.6875 24.8125 C 26.789063 18.914063 28.398438 16.1875 32.5 16.1875 Z M 14.3125 16.5 L 22.6875 16.5 L 22.6875 18.3125 L 15.90625 18.3125 L 15 23.1875 C 15.699219 22.488281 16.789063 22 18.1875 22 C 22.585938 22 23.6875 25.511719 23.6875 27.8125 C 23.6875 31.511719 20.886719 33.40625 17.6875 33.40625 C 13.789063 33.40625 12.3125 30.59375 12.3125 28.59375 L 14.3125 28.59375 C 14.3125 29.695313 15.207031 31.6875 17.90625 31.6875 C 20.605469 31.6875 21.5 29.289063 21.5 27.6875 C 21.5 25.1875 19.6875 23.8125 17.6875 23.8125 C 15.988281 23.8125 14.898438 24.90625 14.5 25.40625 L 12.6875 25.3125 Z M 32.5 17.90625 C 29.898438 17.90625 29 20.507813 29 23.40625 L 29 24.8125 C 29 29.8125 30 31.6875 32.5 31.6875 C 34.699219 31.6875 36 30.210938 36 24.8125 L 36 23.40625 C 36 21.707031 35.601563 17.90625 32.5 17.90625 Z"})});if("scraper"==e)return(0,c.jsx)("svg",{xmlns:"http://www.w3.org/2000/svg",width:"20",height:"20",fill:"currentColor",...d,viewBox:"0 0 50 50",children:(0,c.jsx)("path",{d:"M 28.992188 7 C 23.983187 7 19.408891 9.4429063 17.212891 13.878906 C 16.077891 13.127906 14.747469 12.722656 13.355469 12.722656 C 9.6514687 12.722656 6.6102812 15.610953 6.3632812 19.251953 C 2.5812812 20.629953 1.1842379e-15 24.258078 0 28.330078 C 0 33.662078 4.3379219 38 9.6699219 38 L 24.179688 38 C 24.069688 37.348 24 36.683 24 36 C 24 29.373 29.373 24 36 24 C 42.218 24 47.330453 28.728156 47.939453 34.785156 C 49.224453 33.242156 50 31.260609 50 29.099609 C 50 24.538609 46.554906 20.767859 42.128906 20.255859 C 42.138906 20.064859 42.142578 19.878312 42.142578 19.695312 C 42.142578 12.444312 36.243188 7 28.992188 7 z M 36 26 C 30.488997 26 26 30.488997 26 36 C 26 41.511003 30.488997 46 36 46 C 38.396508 46 40.597385 45.148986 42.322266 43.736328 L 48.292969 49.707031 L 49.707031 48.292969 L 43.736328 42.322266 C 45.148986 40.597385 46 38.396508 46 36 C 46 30.488997 41.511003 26 36 26 z M 36 28 C 40.430123 28 44 31.569877 44 36 C 44 40.430123 40.430123 44 36 44 C 31.569877 44 28 40.430123 28 36 C 28 31.569877 31.569877 28 36 28 z"})});let h=i.GtP[e];if(!h)return(0,c.jsx)(n.In,{icon:e,...d,height:20,width:20});let p=(0,c.jsxs)("div",{className:"inline-block spacing-x-2",children:[(0,c.jsx)(h,{className:(0,l.A)("align-middle",r),name:e,size:s,...d}),(0,c.jsx)("span",{children:o})]});return null!=a?(0,c.jsx)("a",{href:a,children:p}):p}},87349(e,s,r){r.d(s,{A:()=>n});r(96540);var i=r(74848);function n({id:e,title:s,className:r="",bodyClassName:n="",border:t="solid",minWidth:l="120px",compact:c=!1,borderColor:a,headerColor:o,bodyColor:d,children:h}){const p=r.match(/bg-(\w+)-(\d+)/),x=p?`border-${p[1]}-${p[2]}`:"border-slate-300",u="dashed"===t?"border-dashed":"border-solid",j=void 0!==s,m={minWidth:l};a&&(m.borderColor=a);const g={};o&&(g.backgroundColor=o);const f={};return d&&(f.backgroundColor=d),(0,i.jsxs)("div",{id:e,className:`rounded-xl overflow-hidden shadow-lg border-2 ${u} ${a?"":x}`,style:m,children:[j&&(0,i.jsx)("div",{className:`px-3 py-2 text-center ${o?"":r}`,style:g,children:(0,i.jsx)("span",{className:"text-white text-xs font-bold",children:s})}),h&&(0,i.jsx)("div",{className:`${d?"":n} ${c?"p-2":"p-3"}`,style:f,children:h})]})}},39925(e,s,r){r.d(s,{A:()=>c});r(96540);var i=r(56113),n=(r(73985),r(56971)),t=r(74848);function l({className:e}){const s=(0,n.$S)();return(0,t.jsx)(c,{items:s.items,className:e})}function c(e){const{items:s,className:r}=e;if(!s)return(0,t.jsx)(l,{});(0,n.d1)(s).filter(e=>!(e.customProps&&e.customProps.category));return(0,t.jsx)(t.Fragment,{children:(0,t.jsx)(i.C,{children:e.items.map((e,s)=>e.customProps&&e.customProps.category?null:(0,t.jsx)(i.Z,{sidebar:e},s))})})}},21733(e,s,r){r.d(s,{A:()=>t});r(96540);var i=r(68957),n=r(74848);function t(e){return(0,n.jsx)(i.A,{...e})}},28290(e,s,r){r.r(s),r.d(s,{assets:()=>M,contentTitle:()=>z,default:()=>I,frontMatter:()=>R,metadata:()=>i,toc:()=>P});const i=JSON.parse('{"id":"integrations/azure-ad/index","title":"Azure AD / Entra ID","description":"Mission Control scrapes identity data from Entra ID and stores it in a unified catalog alongside your infrastru

1cture (AWS, Azure, Kubernetes, SQL Server, Azure DevOps) and custom applications. The Application CRD maps this catalog data into access and audit reports \u2014 giving you a single view of who has access to what, when they last used it, and whether it\'s been reviewed.","source":"@site/docs/integrations/azure-ad/index.mdx","sourceDirName":"integrations/azure-ad","slug":"/integrations/azure-ad/","permalink":"/docs/integrations/azure-ad/","draft":false,"unlisted":false,"editUrl":"https://github.com/flanksource/docs/tree/main/docs/integrations/azure-ad/index.mdx","tags":[],"version":"current","frontMatter":{"title":"Azure AD / Entra ID","sidebar_custom_props":{"icon":"entra"}},"sidebar":"integrations","previous":{"title":"IAM","permalink":"/docs/integrations/aws/iam"},"next":{"title":"Getting Started","permalink":"/docs/integrations/azure-ad/getting-started"}}');var n=r(74848),t=r(28453),l=r(39925),c=(r(34351),r(28211)),a=r(96540),o=r(7351),d=r(28063),h=r.n(d),p=r(97486),x=r(87349);const u="#2d7de4",j="#f7fbfe",m="#1069dc",g="#62758a",f="#10b981",b={color:g,backgroundColor:j,border:`1px solid ${u}`},A={color:u,strokeWidth:3,headSize:4,dashness:{strokeLen:10,nonStrokeLen:5,animation:1}},v={color:g,strokeWidth:2,headSize:3,dashness:{strokeLen:6,nonStrokeLen:4,animation:1}};function C({children:e}){return(0,n.jsx)("div",{className:"text-[10px] rounded px-2 py-1 text-center",style:b,children:e})}function y({title:e,items:s,id:r}){return(0,n.jsxs)("div",{id:r,className:"flex flex-col gap-1",children:[(0,n.jsx)("div",{className:"text-[9px] font-bold uppercase tracking-wide",style:{color:g},children:e}),s.map(e=>(0,n.jsx)(C,{children:e},e))]})}function w({id:e,icon:s,label:r}){return(0,n.jsxs)("div",{id:e,className:"flex flex-col items-center gap-1 px-2 py-1",children:[(0,n.jsx)(s,{className:"w-7 h-7",style:{color:m}}),(0,n.jsx)("span",{className:"text-[10px] font-bold",style:{color:g},children:r})]})}const N=[{name:"J. Smith",role:"Admin",lastAccess:"2h ago",reviewed:"30d ago"},{name:"A. Chen",role:"User",lastAccess:"1d ago",reviewed:"7d ago"},{name:"svc-deploy",role:"User",lastAccess:"5m ago",reviewed:"Never"}];function L(){const e={color:g,fontSize:"9px",padding:"2px 6px",whiteSpace:"nowrap"},s={...e,fontWeight:700,borderBottom:`1px solid ${f}`};return(0,n.jsxs)("table",{className:"w-full",style:{borderCollapse:"collapse"},children:[(0,n.jsx)("thead",{children:(0,n.jsx)("tr",{children:["User","Role","Last Access","Reviewed"].map(e=>(0,n.jsx)("th",{style:s,children:e},e))})}),(0,n.jsx)("tbody",{children:N.map(s=>(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{style:e,children:s.name}),(0,n.jsx)("td",{style:e,children:s.role}),(0,n.jsx)("td",{style:e,children:s.lastAccess}),(0,n.jsx)("td",{style:e,children:s.reviewed})]},s.name))})]})}function S({className:e}){const s=(0,a.useId)(),r=e=>`${s}-${e}`;return(0,n.jsxs)("div",{className:`${e||""} relative py-8`,style:{minWidth:"950px"},children:[(0,n.jsxs)("div",{className:"flex items-start justify-center gap-6",children:[(0,n.jsx)("div",{id:r("entra"),className:"self-center",children:(0,n.jsx)(x.A,{title:(0,n.jsxs)("span",{className:"flex items-center justify-center gap-2",children:[(0,n.jsx)(p.Vyg,{className:"w-5 h-5"}),"Entra ID"]}),headerColor:u,bodyColor:j,borderColor:u,minWidth:"180px",children:(0,n.jsxs)("div",{className:"flex flex-col gap-3",children:[(0,n.jsx)(y,{title:"Identity",items:["Users & Groups","App Registrations","Enterprise Apps","Role Assignments"]}),(0,n.jsx)(y,{id:r("signin"),title:"Sign-in Logs",items:["Interactive","Non-interactive"]})]})})}),(0,n.jsx)("div",{className:"flex flex-col items-center self-end mb-2",style:{minWidth:"180px"},children:(0,n.jsxs)("div",{className:"flex gap-3",children:[(0,n.jsx)(w,{id:r("loganalytics"),icon:p.CRn,label:"Log Analytics"}),(0,n.jsx)(w,{id:r("eventhub"),icon:p.ln0,label:"Event Hub"})]})}),(0,n.jsx)("div",{id:r("mc"),className:"self-center",children:(0,n.jsx)(x.A,{title:(0,n.jsxs)("span",{className:"flex items-center justify-center gap-2",children:[(0,n.jsx)(p.feH,{className:"w-5 h-5"}),"Mission Control"]}),headerColor:u,bodyColor:j,borderColor:u,minWidth:"240px",children:(0,n.jsxs)("div",{className:"flex flex-col gap-3",children:[(0,n.jsx)(y,{title:"Catalog",items:["Users & Groups","Roles & Policies","Access Records","Sign-in Logs"]}),(0,n.jsx)("div",{className:"w-full h-px",style:{backgroundColor:u,opacity:.2}}),(0,n.jsx)(y,{title:"Scrapers",items:["HTTP Scraper","Logs Scraper","PubSub Scraper"]})]})})}),(0,n.jsx)("div",{style:{minWidth:"60px"}}),(0,n.jsx)("div",{id:r("report"),className:"self-center",children:(0,n.jsx)(x.A,{title:"Audit Report",headerColor:f,bodyColor:j,borderColor:f,compact:!0,minWidth:"220px",children:(0,n.jsx)(L,{})})})]}),(0,n.jsx)(h(),{start:r("entra"),end:r("mc"),...A,startAnchor:"right",endAnchor:"left"}),(0,n.jsx)(h(),{start:r("entra"),end:r("mc"),...v,startAnchor:{position:"right",offset:{y:110}},endAnchor:{position:"left",offset:{y:110}},path:"straight"}),(0,n.jsx)(h(),{start:r("mc"),end:r("report"),...A,startAnchor:"right",endAnchor:"left"})]})}function k(e){return(0,n.jsx)(o.A,{fallback:(0,n.jsx)("div",{className:"w-full"}),children:()=>(0,n.jsx)(S,{...e})})}const R={title:"Azure AD / Entra ID",sidebar_custom_props:{icon:"entra"}},z=void 0,M={},P=[{value:"What Gets Scraped",id:"what-gets-scraped",level:2},{value:"Config Types",id:"config-types",level:3},{value:"Relationships",id:"relationships",level:3},{value:"App Role Assignments and Config Access",id:"app-role-assignments-and-config-access",level:3},{value:"Permissions",id:"permissions",level:3},{value:"Sub-pages",id:"sub-pages",level:2}];function D(e){const s={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(c.v0,{children:(0,n.jsx)(c.U_,{type:"scraper"})}),"\n",(0,n.jsxs)(s.p,{children:["Mission Control scrapes identity data from Entra ID and stores it in a unified catalog alongside your infrastru

1cture (AWS, Azure, Kubernetes, SQL Server, Azure DevOps) and custom applications. The ",(0,n.jsx)(s.a,{href:"/docs/guide/audit/applications",children:"Application CRD"})," maps this catalog data into access and audit reports \u2014 giving you a single view of who has access to what, when they last used it, and whether it's been reviewed."]}),"\n",(0,n.jsx)(k,{className:"mx-auto"}),"\n",(0,n.jsx)(s.hr,{}),"\n",(0,n.jsx)(c.tb,{type:"scraper"}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.strong,{children:"Use cases:"})}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:"Discover users, groups, and their memberships across your tenant"}),"\n",(0,n.jsx)(s.li,{children:"Track app registrations, client secrets, and certificate expiry"}),"\n",(0,n.jsx)(s.li,{children:"Audit app role assignments \u2014 who has access to which applications and when"}),"\n",(0,n.jsx)(s.li,{children:"Correlate identity data with AWS IAM, Kubernetes RBAC, Azure DevOps, and SQL Server access"}),"\n",(0,n.jsxs)(s.li,{children:["Build access and audit reports for both infrastructure and custom applications using the ",(0,n.jsx)(s.a,{href:"/docs/guide/audit/applications",children:"Application CRD"})]}),"\n"]}),"\n",(0,n.jsx)(s.h2,{id:"what-gets-scraped",children:"What Gets Scraped"}),"\n",(0,n.jsx)(s.h3,{id:"config-types",children:"Config Types"}),"\n",(0,n.jsxs)(s.table,{children:[(0,n.jsx)(s.thead,{children:(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.th,{children:"Config Type"}),(0,n.jsx)(s.th,{children:"Class"}),(0,n.jsx)(s.th,{children:"Description"})]})}),(0,n.jsxs)(s.tbody,{children:[(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Azure::User"})}),(0,n.jsx)(s.td,{children:"-"}),(0,n.jsx)(s.td,{children:"Scraped as users (not config items)"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Azure::Group"})}),(0,n.jsx)(s.td,{children:"-"}),(0,n.jsx)(s.td,{children:"Scraped as groups with membership"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Azure::AppRegistration"})}),(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"AppRegistration"})}),(0,n.jsx)(s.td,{children:"Applications registered in the tenant"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Azure::AppRegistration::ClientSecret"})}),(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"ClientSecret"})}),(0,n.jsx)(s.td,{children:"Client secret credentials (child of app registration)"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Azure::AppRegistration::Certificate"})}),(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"ClientCertificate"})}),(0,n.jsx)(s.td,{children:"Certificate credentials (child of app registration)"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Azure::EnterpriseApplication"})}),(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"EnterpriseApplication"})}),(0,n.jsx)(s.td,{children:"Service principals representing apps"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Azure::AuthenticationMethod"})}),(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"AuthenticationMethod"})}),(0,n.jsx)(s.td,{children:"Tenant-level auth method policies (MFA, FIDO2, etc.)"})]})]})]}),"\n",(0,n.jsx)(s.admonition,{type:"note",children:(0,n.jsxs)(s.p,{children:["Mission Control stores users and groups as ",(0,n.jsx)(s.strong,{children:"users"})," and ",(0,n.jsx)(s.strong,{children:"groups"}),", not as config items. They appear in the access control views when linked through an ",(0,n.jsx)(s.a,{href:"/docs/guide/audit/applications",children:"Application CRD"}),". Mission Control stores app registrations and enterprise applications as config items in the catalog."]})}),"\n",(0,n.jsx)(s.h3,{id:"relationships",children:"Relationships"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"App Registration -> Client Secrets / Certificates"}),": Parent-child relationship. Secrets and certificates appear as children of their app registration."]}),"\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"Enterprise Application -> App Registration"}),": Linked via ",(0,n.jsx)(s.code,{children:"AppServicePrincipal"})," relationship. Each enterprise app is the service principal for an app registration."]}),"\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"Groups -> Users"}),": Group membership is tracked through user-group mappings."]}),"\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"Enterprise Application -> Users/Groups"}),": App role assignments link users and groups to enterprise applications via config access records."]}),"\n"]}),"\n",(0,n.jsx)(s.h3,{id:"app-role-assignments-and-config-access",children:"App Role Assignments and Config Access"}),"\n",(0,n.jsxs)(s.p,{children:["When ",(0,n.jsx)(s.code,{children:"appRoleAssignments"})," is configured, the scraper creates ",(0,n.jsx)(s.strong,{children:"config access records"})," linking users and groups to enterprise applications:"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["For each app role assignment, a ",(0,n.jsx)(s.code,{children:"ConfigAccess"}

1)," record is created with the user or group as the principal"]}),"\n",(0,n.jsxs)(s.li,{children:["If the assignment has a specific app role (not the default nil role), the role is recorded as an ",(0,n.jsx)(s.code,{children:"Role"})]}),"\n",(0,n.jsxs)(s.li,{children:["This data powers the access control views in ",(0,n.jsx)(s.a,{href:"/docs/guide/audit/applications",children:"Applications"})]}),"\n"]}),"\n",(0,n.jsx)(s.h3,{id:"permissions",children:"Permissions"}),"\n",(0,n.jsxs)(s.table,{children:[(0,n.jsx)(s.thead,{children:(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.th,{children:"Permission"}),(0,n.jsx)(s.th,{children:"What It Enables"})]})}),(0,n.jsxs)(s.tbody,{children:[(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"User.Read.All"})}),(0,n.jsx)(s.td,{children:"Users and alias resolution"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Group.Read.All"})}),(0,n.jsx)(s.td,{children:"Groups"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"GroupMember.Read.All"})}),(0,n.jsx)(s.td,{children:"Group memberships"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Application.Read.All"})}),(0,n.jsx)(s.td,{children:"App registrations, enterprise applications"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Directory.Read.All"})}),(0,n.jsx)(s.td,{children:"Service principal metadata, directory roles"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"AuditLog.Read.All"})}),(0,n.jsxs)(s.td,{children:["Sign-in logs via ",(0,n.jsx)(s.a,{href:"./audit-logs/http-scraper",children:"HTTP scraper"})," only (requires P1/P2 license)"]})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"Policy.Read.All"})}),(0,n.jsx)(s.td,{children:"Authentication method policies (MFA, FIDO2, etc.)"})]})]})]}),"\n",(0,n.jsxs)(s.p,{children:["See ",(0,n.jsx)(s.a,{href:"./getting-started",children:"Getting Started"})," for the full permissions table and setup walkthrough."]}),"\n",(0,n.jsx)(s.admonition,{type:"tip",children:(0,n.jsxs)(s.p,{children:["After deploying, follow the ",(0,n.jsx)(s.a,{href:"./getting-started#verification",children:"verification steps"})," to confirm resources are being scraped correctly. For large tenants (10K+ users), see ",(0,n.jsx)(s.a,{href:"./getting-started#performance--scheduling",children:"Performance & Scheduling"})," for schedule recommendations and rate limit guidance."]})}),"\n",(0,n.jsx)(s.hr,{}),"\n",(0,n.jsx)(s.h2,{id:"sub-pages",children:"Sub-pages"}),"\n",(0,n.jsx)(l.A,{}),"\n",(0,n.jsxs)(s.p,{children:["For advanced MS Graph API queries (custom ",(0,n.jsx)(s.code,{children:"$filter"}),", user attributes, pagination), see ",(0,n.jsx)(s.a,{href:"./ms-graph",children:"Microsoft Graph API"}),"."]})]})}function I(e={}){const{wrapper:s}={...(0,t.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(D,{...e})}):D(e)}},28453(e,s,r){r.d(s,{R:()=>l,x:()=>c});var i=r(96540);const n={},t=i.createContext(n);function l(e){const s=i.useContext(t);return i.useMemo(function(){return"function"==typeof e?e(s):{...s,...e}},[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:l(e.components),i.createElement(t.Provider,{value:s},e.children)}}}]);